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AMENDMENTS TO THE CLAIMS 

1 . (Currently Amended) A method for tracking kernel resource usage comprising 
the steps of: 

generating a tag to charge a process allocated with kernel resources , the tag 
identifying the allocated kernel resources charged to the process ; 
determining whether if the process is a kernel process; 
determining if the process is e^a user process; and^ 

flagging the tag with a kernel flag bit to indicate whether if the process is determined 
to be is-a kernel process; 

flagging the tag with a user flag bit if the process is determined to be -e#- a user 
process , based upon the determination stop; 

determining if the process has exceeded a threshold limit of kernel resource usage for 
the process; and 

if the process has exceeded the threshold limit, aborting the process . 

2. (Original) The method of claim 1 wherein said step of generating a tag further 
comprises the steps of: 

determining whether a request for kernel resources is passed from an intermediate 

function using a worker thread; 

finding at least one link between the worker thread and the process; and, 
identifying the process that originated the request according to the found link between 

the worker thread and the process. 

3. (Currently Amended) The method of claim 1 wherein said step of flagging the 
tag with a kernel flag bit further comprises the steps of: 

generating a tag value to identify the kernel resources allocated to a the kernel 
process; and, 

saving a driver identification to the tag value. 

4. (Original) The method of claim 3 wherein the tag value with the driver 
identification is saved in a first word of the tag. 
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5. (Currently Amended) The method of claim 1 wherein said step of flagging the 
tag with a user flag bit further comprises the steps of: 

generating a tag value to identify the kernel resources allocated to a the user process; 
saving a type of kernel resources allocated to the user process tag; and, 
saving a user process identifier to the tag to identify the user process. 

6. (Original) The method of claim 5 wherein the tag value and the type of kernel 
resources are saved in a first word of the tag, and the user process identifier is saved in a 
second word of the tag. 

7. (Currently Amended) The method of claim 1 wherein said step of flagging the 
tag with a user flag bit further comprises the steps of: 

generating a tag value to identify the kernel resources allocated to a the user process; 
saving the tag value to a first word of the tag; and, 

saving a user process identifier to identify the user process to a second word of the 

tag. 

8. (Canceled) 

9. (Currently Amended) The method of claim &1 further comprising the steps of: 
saving a process identifier to identify the process allocated with the kernel resources; 

and, 

saving a type of kernel resources allocated to the process. 

10. (Canceled) 

11. (Canceled) 

12. (Canceled) 

13. (Currently Amended) The method of claim &J_ wherein the first and second 
predefined processes relate to processes process is a process used b y at least one from a 
group including u sers, a group of users, or accounts of the users in a network system. 
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14. (Currently Amended) A method for tracking kernel resource usage comprising 
the steps of: 

generating a tag to charge a process allocated with kernel resources, the process called 
from user level of an operation system , the tag identifying the allocated with kernel 
resources; 

flagging the tag with a user flag bit to indicate that the process is a user process; 
saving a tag value to the tag to identify the kernel resources allocated to the user 
process; andr 

saving a user process identifier to the tag to identify the user process; 
determining if the user process has exceeded a threshold limit of kernel resource 
usage for the user process; and 

if the user process has exceeded the threshold limit, aborting the user process . 

15. (Original) The method of claim 14 wherein the tag value is saved in a first word 
of the tag, and the user process identifier is saved in a second word of the tag. 

16. (Canceled) 

17. (Original) The method of claim 14 wherein said step of saving a tag value further 
comprises the steps of: 

determining whether a request for kernel resources is passed from an intermediate 

function using a worker thread; 

finding at least one link between the worker thread and the process; and, 

identifying the process that originated the request according to the found link between 

the worker thread and the process. 

18. (Original) The method of claim 14 further comprising the step of saving a type of 
kernel resources allocated to the user process to the tag. 

19. (Original) The method of claim 14 wherein said step of saving a user process 
identifier further comprises the steps of: 

extending the tag with a second word; and, 
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saving the user process identifier to the second word of the tag. 

20. (Original) The method of claim 19 further comprising the step of saving the tag 
value to a first word of the tag. 

2 1 . (Currently Amended) A method for tracking kernel resources allocated to kernel 
and user processes indicated by a plurality of tags, the method comprising the steps of: 

identifying an amount of kernel resources allocated to a process indicated by a 
selected ta g, the selected tag having a bit identifying the process as a kernel process if the 
process is a kernel process, and the selected tag having the bit identifying the process as a 
user process if the process is a user process ; 

saving an association of the identified amount of kernel resources allocated with the 
process to a file; 

identifying a type of the kernel resources allocated to the process indicated by the 
selected tag;-and, 

saving an association of the identified type of the kernel resources allocated with the 
process to the file; 

determining if the process has exceeded a threshold limit of kernel resource usage for 
the process; and 

if the process has exceeded the threshold limit, aborting the process. 

22. (Currently amended) The method according to claim 21 further comprising the 
steps of: 

selecting the selected a tag from the plurality of tags; and, 
saving the selected tag to the file. 

23. (Original) The method according to claim 21 further comprising the steps of: 
determining whether there are any more tags from the plurality of tags; and, 
repeating the method for any other tags based upon the determination step. 

24. (Original) The method according to claim 21 wherein the step of identifying the 
type of kernel resources further comprises the steps of: 

determining whether the process is called from the user level; and, 
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performing the step of identifying the type of kernel resources when the process is 
called from the user level. 

25. (Currently amended) A method for managing kernel resource usage comprising 
the steps of: 

reading a usage policy, wherein the usage policy includes data rotating to including 
threshold limits of kernel resource usage for each process according to processes and kernel 
resource type ; and, for each process: 

searching a file to determine an amount of kernel resources used by the each 
process, wherein the file includes a plurality of tags having a tag value identifying the 
kernel resources allocated to the process, a process identifier identifying the process 
allocated with the kernel resources, a flag bit identifying the process as a kernel 
process if the process is a kernel process, and the flag bit identifying the process as a 
user process if the process is a user process , whether the process is a first predefined 
process or a second predefined process, and a kernel resource type identifying the 
type of kernel resources allocated to the process; 

determining whether the amount of kernel resource usage resources used by 
the process exceeds the threshold limits according to the user policy; 

aborting the process if the amount of kernel resources used by the process 
exceeds the threshold limits, and 

updating the file to reflect the aborted process andr 
taking an action according to the usage policy when the amount of kernel resource 
usage is over the threshold limits . 

26. (Canceled) 

27. (Canceled) 

28. (Canceled) 

29. (Canceled) 
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30. (Currently Amended) A tangible computer— readable storage medium having 
computer-executable instructions for performing steps comprising: 

generating a tag to charge a process allocated with kernel resources , the tag 
identifying the allocated kernel resources charged to the process ; 

determining whether if the process is a kernel process; , or a user process; and, 
determining if the process is a user process; a ndr 

flagging the tag with a kernel flag bit to indicate whether if the process is determined 
to be a kernel process or a user process based upon the determination step ; 

flagging the tag with a user flag bit if the process is determined to be a user process; 
storing the tag as an entry in a hash table, 

determining if the process has exceeded a threshold limit of kernel resource usage for 
the process; and 

if the process has exceeded the threshold limit, aborting the process . 

31. (Canceled) 

32. (Currently Amended) A tangible computer-readable storage medium having 
computer-executable instructions for performing steps comprising: 

generating a tag to charge a process allocated with kernel resources, the process called 
from user level of an operating system , the tag identifying the allocated with kernel 
resources; 

flagging the tag with a user flag bit to indicate that the process is a user process; 
saving a tag value to the tag to identify the kernel resources allocated to the user 
process; aftd; 

saving a user process identifier to the tag to identify the user process; 
storing the tag as an entry in a hash table; 

determining if the user process has exceeded a threshold limit of kernel resource 
usage for the user process; and 

if the user process has exceeded the threshold limit, aborting the user process . 

33. (Currently Amended) A tangible computer-readable storage medium having 
computer-executable instructions for performing steps comprising: 
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identifying an amount of kernel resources allocated to a process indicated by a 
selected ta g, the selected tag having a bit identifying the process as a kernel process if the 
process is a kernel process, and the selected tag having the bit identifying the process as a 
user process if the process is a user process ; 

saving an association of the identified amount of kernel resources allocated with the 
process to a file; 

identifying a type of the kernel resources allocated to the process; and^ 
saving an association of the identified type of the kernel resources allocated with the 
process to the file; 

determining if the process has exceeded a threshold limit of kernel resource usage for 
the process; and 

if the process has exceeded the threshold limit, aborting the process . 

34. (Currently Amended) A tangible computer-readable storage medium having 
computer-executable instructions for performing steps comprising: 

reading a usage policy, wherein the usage policy includes data relating to including 
threshold limits of kernel resource usage for each process according to processes and kernel 
resource typo ; and, for each process: 

searching a file to determine an amount of kernel resources used by the each 
process, wherein the file includes a plurality of tags having a tag value identifying the 
kernel resources allocated to the process, a process identifier identifying the process 
allocated with the kernel resources, a flag bit identifying the process as a kernel 
process if the process is a kernel process, and the flag bit identifying the process as a 
user process if the process is a user process , whether the process is a first predefined 
process or a second predefined process, and a kernel resource type identifying the 
type of kernel resources allocated to the process; 

determining whether the amount of kernel resource usage resources used by 
the process exceeds the threshold limits according to the user policy; 

aborting the process if the amount of kernel resources used by the process 
exceeds the threshold limits, and 

updating the file to reflect the aborted process and? 
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taking an action according to the usage policy when the amount of kernel resource 
usage is over the threshold limits. 



9 



